No question of deleting Aadhaar data: UIDAI CEO Ajay Bhushan Pandey

There are other options such as eAadhaar and QR code that can ensure business as usual for banks, telecom companies and fin-tech firms, UIDAI CEO Ajay Bhushan Pandey said.

There is no question of the Unique Identification Authority of India (UIDAI) deleting Aadhaar data except for minor children, saidAjay Bhushan Pandey, chief executive of the Aadhaarissuing body. In an interview to ET, he said the Supreme Court has upheld the enrolment of members retrospectively before the Aadhaar Act came into effect. As for companies, it is up to them and their sectoral regulators to implement the court’s order banning private entities from using the identity framework for authentication, he said. There are other options such as eAadhaar and QR code that can ensure business as usual for banks, telecom companies and fin-tech firms, he said. Excerpts:

Banks and telecom companies are the worst impacted. What is your take on how their services are going to be disrupted? What will UIDAI do to assuage those concerns?UIDAI will follow the verdict of the court and would ensure that the court’s order is implemented at its end at the earliest. The court order is also available to the banks and telecom companies and their sector regulators. Many of them were parties in the court too. It is expected that they will comply with the order at their end too at the earliest. This is because they are in the best position to know exactly what kind of operations they are running, for what purpose they collected and used Aadhaar- for example, whether they did it for giving loan, opening or verifying bank accounts, giving SIM cards, and if they did so, then how to replace the Aadhaar eKYC with other valid documents so to comply with the orders of the court and their regulators and ensure continuity of service to their customers, etc.

Are you saying that the onus is on the private companies to evolve a method to figure out how to implement the order?As explained just now, as per the Aadhaar Act we did not collect the specific purpose for which Aadhaar authentication was requested. They know for what purpose they collected Aadhaar from their customers. Only they and their sector regulators would know how best to implement the order and therefore need to evolve a method to implement the same. In case they come to us for certain clarifications, we will provide that.

But how is UIDAI or the government going to guide them in understanding what is to be done, amid all the confusion that is prevailing? For example, some people are saying data has to be deleted in 6 months. Somebody is saying telcos have to delete data in 2 weeks..The order is absolutely clear and there is no scope of any confusion. Rather than listening to what some random people are saying, they should read the verdict first.

That is okay but the language of the verdict may be subject to interpretation and it’s a long order.No one has authority to interpret the Court’s order for somebody else. If the agencies need assistance in understanding the order, they can take legal advice and follow the order.

So, what has the court said on the issue of data deletion?So far as UIDAI is concerned, the authentication log has to be deleted after 6 months. And we will delete this. This is the part that concerns us. The part that concerns other agencies and regulators, has to be looked at by them. And they need to do what is required as per the order.

Do you think UIDAI is in some way washing hands off its responsibility after helping these agencies. Some of these companies built their business models..There is no question of UIDAI washing its hands. As I said, no one has authority to interpret the Court’s order for some other agencies. Everybody has to implement the order of the court that concerns its business.

Why can’t we issue clear directions saying that this is what the court has said banks and telecom companies have to do. The order of the court is very clear. I don’t think somebody needs to issue a circular giving the gist of the order. No one can take the responsibility of interpreting or summarizing the order. The order is available in public domain in black and white. The concerned agencies and their regulators should see the order and take action. That is applicable to all. If they have a confusion, they can take legal advice or seek clarification from the court.

These requests for deletions have to come to whom?UIDAI has been asked to delete the authentication log after six months and we will do that. If there are other things applicable to other parties, they will have to do their bit.

Fintech companies and other private firms are feeling very lost. They think their entire business is going to suffer. What would you like to say?There are no reasons for their feeling lost. According to me, such initials views are on account of lack of understanding of the order. They have to read the order and accordingly evolve a process so that they can perform their business and operations in a manner consistent with the order. I personally think that they should have no technical difficulty in implementing the order of the Supreme court.

How? An entire fin-tech industry had been built around the India stack model. They can’t access e-KYC now.There are technologies which have been recently made available by UIDAI during the last few months to verify identity without authentication and at the same time address privacy concerns of people. An Aadhaar holder can now download xml or print the e-Aadhaar without Aadhaar number being mentioned on it. There is also a QR code which contains only basic demographic details – only name, address, gender, date of birth and photo but no Aadhaar number or biometrics. Since it is digitally signed by us, it requires no authentication from Aadhaar server. Now Fintech companies can accept this QR code or e-Aadhaar on voluntary basis from their potential customers and based on that they can carry on their business. This is a method through which the startup and fintech will can carry their business and at the same time protect the privacy of the people. This will also be in line with the Supreme Court order. The start-up ecosystem can start building around that.

But do we have clarity on whether Aadhaar can be continued to be used as means of identity. Aadhaar as an identity and Aadhaar as a means of authentication through biometrics are two separate things. We are saying that people can provide their Aadhaar on voluntary basis, as a means of proving identity, is that allowed after this judgement?If you have an Aadhaar card, you can use your Aadhaar card on a voluntary basis, like you use you voter ID, ration card or DL etc. But if somebody insists on accepting only Aadhaar card and nothing else, then he is in violation of the SC order. That is not permitted. So, it is okay if the choice is given to the individual for Aadhaar and he uses it without involving the UIDAI for authentication.

Does that mean biometrics can’t be used for authentication?That is correct. The law does not permit that. Biometric authentication can only be used or a purpose only if it is backed by law. However, a physical print out of Aadhaar or e- Aadhaar in electronic form can be used just like we are using PAN or voter ID card on a voluntary basis, with the restriction that the Aadhaar numbers cannot be stored. If an agency is accepting paper Aadhaar card, the Aadhaar number printed on the paper has to be redacted.

You said fintech companies can use Aadhaar in other ways. What would you say for services like Jio which used instant e-KYC or payment banks which were conducting instant account opening? Today, the technology allows it even without Aadhaar authentication. That is what we are saying. As I said earlier Aadhaar card has a QR code which can be scanned offline or online for giving SIM cards or opening bank accounts. A QR code or E-Aadhaar which only name, address, photo information, without Aadhaar number or Aadhaar authentication, is equivalent to ration card or voter ID card so far as privacy is concerned. Rather it would be much more secure than ration card or voter ID, etc., because it is digitally signed. It can be used by people only if it is not made mandatory. They have to also accept other means of identification authentication. So, the fintech industry or other industries have to build the system in a manner that they should be able to accept other ID documents too in addition to Aadhaar and provide services and when they are accepting Aadhaar, they can also either accept the physical Aadhaar card where the Aadhaar number is redacted or use the downloaded electronic version of E-Aadhaar card which does not have Aadhaar number so that nobody is able to build a database of Aadhaar numbers of even those individuals who may have used their Aadhaar voluntarily.

Do you think (the Supreme Court verdict) is some kind of a setback to the entire Aadhaar eco system? I do not think there is a setback. On the contrary, it is going to strengthen the start-up and digital India because this judgment provides a basis India’s digital journey with safeguards. If there is development without safeguards, at some stage later you have to take many steps backwards. And that instead would be a setback. In fact, this judicious and voluntary use of Aadhaar will be a model for the world to follow in their ID and service delivery systems.

Don’t you think that is precisely what has happened? We were moving ahead but we did not take enough safeguards.Aadhaar has been constantly bringing several safeguards to meet the challenges. And that is why we have now these options of the - like QR code, offline QR code, virtual ID, etc which will enable the country to move ahead without compromising the privacy of the people. The only thing that the court has said is that private companies will not do authentication unless it is backed by law. Ease of business has to go hand in hand with data protection and privacy. The two are not in conflict.

But do we have absolute clarity on the point that Aadhaar can be voluntarily used as a means of proving identity?Yes, but without authentication and the storage of Aadhaar number by the agency.

As far as legal backing is concerned, section 57 clearly says that pursuant to a law some of this may be allowed. What are your thoughts on that?Aadhaar has been permitted for all schemes which are funded out of the Consolidated Fund of India. Similarly, in the case of income tax also, the requirement of the existence of law, proportionality, and legitimate state interest has been met. Tomorrow, there could be some other sectors where there may be legitimate state interest, uses are a proportional, they can convince the legislature to bring in appropriate laws.

But this is only for mandatory, isn’t it? If the passport office says that you should get tatkal done through Aadhaar, then it will be faster.The law can authorize mandatory as well as non-mandatory uses provided the concerned sectors convince the legislature. As far as I recall, the passport rules require that for Tatkaal passport, if one gives Aadhaar, his identity is verified immediately through authentication and passport is issued. There is also an option not to give Aadhaar and go through manual verification through police and then the passport issued. This empowers people with choice.

Which sectors do you think would require this?I would not know that. That is the domain of the sector regulators.

If you look at some of the main use cases including EPFO, Passports, Election Commission.This is something these sectors would have to figure out for themselves. They will have to make out a case before the legislature, saying here is a case which has legitimate state aim and which is proportional and therefore they want to use Aadhaar authentication in either mandatory manner or non-mandatory manner.

Do you think there will be some changes to the Aadhaar Act?Certain suggestions have been made by Justice Srikrishna Committee in which I too was a member. That will further strengthen Aadhaar. Many of the recommendations are almost in line with what the Supreme Court has suggested. For ex: one of the proposed amendments is that Aadhaar authentication will be permitted only if there is a law. Similarly, for allowing filing of complaints by individuals, etc.

Are you going to start work on amending the Act based on recommendations?Already, the Srikrishna Committee has submitted the report and the govt. will take a view. It is under examination currently.

Some experts are saying that people can seek to delete themselves from the Aadhaar database, how do you plan to go about it?So far as the majority judgement is concerned, the Supreme Court has upheld Section 59 of the Aadhaar Act which validates all the actions in Aadhaar project which were taken prior to 2016. So all the biometrics and everything which was done, collected, and Aadhaar generated prior to 2016 have been validated by Section 59, which has been held constitutional.

What if people send requests for deletions to UIDAI?As I said that once section 59 has been held valid by the Supreme Court, the question of deletion of Aadhaar enrolment data collected prior to promulgation of the Aadhaar Act doesn’t arise. The court has said that the children who were enrolled with parental consent, should be given an option of exit when they attain the majority, so in such cases UIDAI will provide them this option.

As far as Aadhaar Pay, what kind of impact do you see?The government gives subsidy every year through DBT. On an average 12 crore people are getting LPG subsidy every month. Each one is getting at the current rate around Rs. 300. So Pahal subsidy going directly to people’s bank accounts is around Rs. 3600 crore every month. Similarly old age pensions and MGNREGS wages, etc., are going into the bank accounts of beneficiaries directly. The beneficiaries also need means to withdraw that money, because there is no brick and mortar bank or ATM in large part of rural areas. So in order to enable these beneficiaries to withdraw that money from their bank accounts, AePS or BHIM Aadhaar will have to be continued. These uses are permissible as per the orders of the Court. However, if a person who is not a subsidy holder, has a choice to get his data deleted from NPCI mapper and not to use the AePS or BHIM Aadhaar Pay facility.

But the scope of Bhim Aadhaar Pay now gets limited to people who were only getting subsidy?Obviously, if the court has said that you can use Aadhaar only for subsidy schemes and income tax, so naturally those schemes which are not covered, they will not be able to use Aadhaar. But there is no impact on the Bhim Aadhaar Pay.

What about enrolment centres at bank branches and all, will some of them shut down leading to job losses, etc?No. They will continue. See, more than 122 crore people have Aadhaar. Two crore children are born every year. Two crore children will cross the age of five, and approximately the same number will cross the age of 18 whose biometrics will have to be collected. Plus, other people will need to change their address, photo etc and therefore, we have estimated approximately 30 crore enrolments and updates will take place for which a large network of Aadhaar centers will be required.

You also have to see what kind of value Aadhaar brings, even if it is largely restricted to voluntary usage without authentication. Before Aadhaar Act came into force, almost 100 crore people had already enrolled. At that time, there was no compulsion, yet people realized the value in having this trusted identity on a voluntary basis and went for it. Aadhaar centers in banks will be useful to their existing and potential customers.

Any chances of Government filing a curative petition in the Supreme Court for review of some part of the judgement, which you think needs a review?At this point of time, as far as the UIDAI is concerned, this judgement has just come and there is no such proposal.